New Technology File System (NTFS) Attributes

The New Technology File System (NTFS) uses a special database (called the Master File Table (MFT)) to track all the files and directories on a volume. The size of the Master File Table (MFT) is automatically extended when necessary. The records in Master File Table database contain attributes that makes the file system like files, directories, filenames etc. A description about these attributes are listed below.

Standard Information: Standard Information attribute contains the standard file attributes (Read-only, Hidden, System, and Archive) and also timestamps.

Attribute List: Attribute List lists the location of all attribute records that do not fit in the MFT record. This attribute is placed in the original MFT record to act as a pointer to the non-resident attribute.

File Name: File Name attribute contains the name of the Master File Table (MFT) record. The long name of the file can be up to 255 Unicode characters. The Fine Name can have multiple file name attributes, to allow the storage of the long name the file, MS-DOS short filename alias and also POSIX-like hard links from multiple directories

Security Descriptor: Security Descriptor attribute is no longer used. Security Descriptor attribute is replaced by entries in the $Secure metadata record. The Security Descriptor attribute in an MFT record contains an index number for the $Secure entry that represents the security descriptor for the MFT record. This describes who owns the file and who can access it.

Data: Data attribute stores the contents of a file. An Master File Table (MFT) record can have multiple Data attributes.

Index Allocation, Index Root and Bitmap: Index Allocation is used to implement folders and other indexes. They are used to index Master File Table (MFT) and they are also used to index other attributes to support features such as link tracking and reparse points.

Reparse Point: Reparse Point attribute contains a pointer to a volume, folder record, or device.

Logged Utility Stream: Logged Utility Stream attribute is used by the Encrypting File System.

Volume Information: Volume Information is used only in the $Volume system file. It contains the volume version.

Volume Name: Volume Name is used only in the $Volume system file. It contains the volume label.

Related Tutorials